Security principles and guidelines

We are naturally very interested in the security of our clients’ finances and their internet banking. This is why we have prepared a few recommendations on how to avoid any potential unpleasant situations.

Never enter your personal data, access details, logins, passwords,PINs or telephone numbers anywhere based on an email you received. The bank will never ask for these personal data in electronic communication.

The access to internet banking is protected by means of an automatically generated user name and password. In addition, you can enable login authentication via SMS. We recommend that you enable this option.

Our internet banking uses the HTTPS protocol. This means the site’s validity is verified using a certificateissued by VeriSign, an internationally recognised certification authority. Our certificate corresponds to the name of our bank: “Equa bank a.s.”

Keep the operating system and the web browser used on your computer updated.

You cannot keep your computer secure without having an up-to-date antivirus, antispyware and firewall softwareinstalled on your computer.

If you receive spam e-mail containing a link to Equa bank a.s. website,do not respond to the email and do not click on the link – instead, contact our Customer Service.

Phishing refers to a method of obtaining sensitive data (passwords, credit card numbers, etc.) on the Internet. It consists in sending email messages, usually written in bad Czech or in English, which look like an official request from the bank or from a similar institution. The addressees are asked to enter their personal data on a linked website. Such a website may, for example, imitate the internet banking login window, where the user enters his or her login name and password. By doing this, the user divulges these details to the attackers, who are then able to use them and freely dispose of the account.

Pharming

A more insidious form of Phishing, which helps the attackers to obtain sensitive data. The attacker redirects the client to a fake website (e.g. IBS) and thus tricks the user into divulging his or her login details. Such websites are usually unrecognisable from the real website of the bank. Not even experienced users can reliably spot the difference (in contrast to phishing, a similar method).

Most common tricks used in fraudulent e-mails:

Imitating the bank.

A link to a fake website which is very similar to the original website and where the user is prompted to enter his or her personal data, access details, logins and passwords.

Request for a quick response, where the e-mail is applying pressure on the user, threatening e.g. that his or her account will be blocked if (s)he does not login to the account by the end of the day.

How to protect yourself against Phishing and Pharming

Never click on links in emails which require you to enter personal data, access details, logins or passwords.

Never login into the internet banking using internet addresses given in an email.

When entering the internet banking website, always enter the service’s internet address (URL) in the address bar of your browser in a newly opened tab.

Keep your operating system and antivirus updated and use the latest version of your web browser.

Do not use publicly accessible computers to enter personal data or to manage your account.

Verify secure communication (the SSL certificate) in case it is offered.

Social Engineering

Social engineering, in the context of information security, refers to psychological manipulation of people into believing the attacker is a different person with the goal of making them perform certain actions or divulge confidential information. These methods involve the attacker trying to persuade the victim to divulge an important information. For example, a password may be disclosed to somebody who calls the victim on the phone, posing as the system administrator.

Aside from standard mail, social engineering attacks are most commonly performed using telephone or the Internet (email, chat, Facebook). Experienced social engineers may carry out “face to face” attacks. If the attacker knows his victim personally, he may guess the victim’s password on the basis of the information he gathered about the person. Typically, he tries details such as place of birth, nickname, the name of a village where the victim has a summer house, name of the victim’s dog, etc.

Social engineers take advantage of people’s common traits, such as their trust in other people, occasional laziness, inability to spot minor differences, the willingness to help others, and fear of getting into trouble. If the attacker has a vested interest in the success of the attack, he may dedicate a longer period of time to building confidence.

Skimming refers to a way of obtaining data from the magnetic strip of a card using a reader device, without the user being aware of this. The data are subsequently used to produce a counterfeit card. The reader device, i.e. the scanner, is placed directly on the payment terminal. It consists of a part which reads data from the payment card and a part enabling it to obtain the PIN. Both have to be obtained for the attackers to be able to produce a counterfeit and freely use it. You can encounter skimming not only at ATMs, but also during payment in bars, restaurants, at petrol stations, etc.

How to protect yourself:

Never leave your card unattended

Keep your PIN secret and do not write it down

Before withdrawing money from an ATM, check the ATM for modifications (e.g. the keypad is covered by a plastic sheet, it is strangely sunk into the board, an unauthorised reader is installed as depicted in the picture, etc.)

While entering PIN on the keypad, cover the number keys with your other hand (in order to prevent others from seeing the numbers you are entering)

Remain vigilant while withdrawing money from an ATM (e.g. watch out for strange persons nearby, unusual lighting on the ATM, etc.)

When paying in a shop, always think about how trustworthy the merchant is. Check the correctness of the details, the date and time and the amount on the receipt after payment. If you have doubts, do not pay by card.

Never make online payments on a computer you do not trust or on a public computer.

Regularly check your account through the internet banking and the account statements. This could help you find out about possible discrepancies early. (You can enable notifications of movements on your account.)

If you lose your card, inform your bank without delay. This will prevent it from being misused. Immediately block the payment card in your internet banking or on the Customer Service phone number: +420 222 010 222.

How does it work?

The fraudulent reader device is placed over the original device

The device scans the card data while the camera records your PIN number being entered

The device is then connected to a PC to which your card data are downloaded

The internet is full of hackers and fraudsters who want to obtain sensitive data, login details and payment card information by means of creating fake websites, by intercepting communications, or otherwise. You can defend yourself against them by using the SSL certificate, which makes sure the communications are encrypted. The certificate also serves to positively identify specific servers.

How to verify the website’s security

If the URL address of a website starts with https://, this means the communication between the browser and the server is secure (encrypted).

Secure communication

Symbol indicating an invalid certificate​

The security and validity of a certificate may be verified in the browser by clicking on the lock symbol in the address bar, where you can find more details about the certificate.

Secure communication

The certificate details contain information on the owner, the certification authority, and technical information on the connection with the server and the name of the server ( www.equabanking.cz).

This is what the address bar in your browser should look like during login into the internet banking: